Versions Compared

Version Old Version 1 New Version Current
Changes made by

Svetlana Sheptiy

Andrew Madge

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

...

Description

SharePoint file operation events.

Log Structure

Expand
titleSample Office365SharePointFileOperation logof Office365SharePointFileOperation Event (in JSON format)
[
{
"AppAccessContext": {
"AADSessionId": "9a8cf76d-d754-3e2e-b10d-9bb87654f3b2",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"UniqueTokenId": "aBCde-XYZUm77sUdZIgDDD"
},
"CreationTime": "2022-03-01T02:38:44",
"Id": "80c76bd2-9d81-4c57-a97a-accfc3443dca",
"Operation": "FileAccessed",
"OrganizationId": "41463f53-8812-40f4-890f-865bf6e35190",
"RecordType": 6,
"UserKey": "1153977025279851686@contoso.onmicrosoft.com",
"UserType": 0,
"Version": 1,
"Workload": "SharePoint",
"ClientIP": "134.170.188.221",
"ObjectId": "https://contoso-my.sharepoint.com/User Photos/Profile Pictures/admin_contoso_onmicrosoft_com_MThumb.jpg",
"UserId": "admin@contoso.onmicrosoft.com",
"CorrelationId": "123455a0-807b-1111-cd61-7e477227f33a",
"DoNotDistributeEvent": true,
"EventSource": "SharePoint",
"ItemType": "File",
"ListId": "f1c23344-5667-890f-1234-8ee1171747ad",
"ListItemUniqueId": "a11111bc-8394-40d1-8e2f-a0b6c3334455",
"Site": "9876ded5-e4df-32e1-b123-bcec4d5ce67a",
"UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36",
"WebId": "7777777a8-d0b9-001f-be0b-f9c12345cd48",
"HighPriorityMediaProcessing": false,
"SourceFileExtension": "jpg",
"SiteUrl": "https://contoso-my.sharepoint.com/",
"SourceFileName": "admin_contoso_onmicrosoft_com_MThumb.jpg",
"SourceRelativeUrl": "User Photos/Profile Pictures"
}
]

Table Fields

Field

Description

TABLE

Office365SharePointFileOperation

RECORDTYPE

Based on RecordType

is “6” - details

, this field indicates the operation performed by the record.
For this log type its value is 6
For available RecordType values, you can visit Microsoft’s documentation here.

AADSESSIONID

AADSessionId - Value will be based on AppAccessContext→AADSessionId

Based on AADSessionId, a value derived from the AppAccessContext field.

SITEURL

SiteUrl - The

Based on SiteUrl, this field contains the URL of the site

where

the file or folder accessed by the user is located.

SRCRELATIVEURL

SourceRelativeUrl - The

Based on SourceRelativeUrl, this field contains the URL of the folder that contains the file accessed by the user.

The combination of the values for the SiteURL, SourceRelativeURL, and SourceFileName parameters is the same as the value for the ObjectID property, which is the full path name for the file accessed by the user.

SRCFILENAME

SourceFileName - The

SRCFILENAME

Based on SourceFileName, this field contains the name of the file or folder accessed by the user.

SRCFILEEXTENSION

SourceFileExtension - The

Based on SourceFileExtension, this field contains the file extension of the file that was accessed by the user.

This property is blank if the object that was accessed is a folder.

DSTRELATIVEURL

DestinationRelativeUrl - The

Based on DestinationRelativeUrl, this field contains the URL of the destination folder

where

a file is copied or moved.

The combination of the values for SiteURL, DestinationRelativeURL, and DestinationFileName parameters is the same as the value for the ObjectID property, which is the full path name for the file that was copied.

This property is displayed only for FileCopied and FileMoved events.

DSTFILENAME

DestinationFileName - The

DSTFILENAME

Based on DestinationFileName, this field contains the name of the file that is copied or moved

.This property is displayed only for FileCopied and FileMoved events

.

DSTFILEEXTENSION

DestinationFileExtension - The

Based on DestinationFileExtension, this field contains the file extension of a file that is copied or moved

.This property is displayed only for FileCopied and FileMoved events

.

USERSHAREWITH

UserSharedWith - The

Based on UserSharedWith, this field contains the user that a resource was shared with.

SHARINGTYPE

SharingType - The

Based on SharingType, this field contains the type of sharing permissions that were assigned to the user that the resource was shared with.

This user is identified by the UserSharedWith parameter.

LISTID

ListId - The

Based on ListId, this field contains the Guid of the list

. This information is present only if it is applicable

.

LISTITEMUNIQUEID

ListItemUniqueId - The

Based on ListItemUniqueId, this field contains the ID of the application performing the operation.

WEBID

WebId - No

Based on WebId, there’s no available documentation for this field.

FILESIZE

FileSizeBytes - No

Based on FileSizeBytes, there’s no available documentation for this field.

HIGHPRIOMEDIAPROC

HighPriorityMediaProcessing - No

Based on HighPriorityMediaProcessing, there’s no available documentation for this field.

IMPLICITSHARE

ImplicitShare - No

Based on ImplicitShare, there’s no available documentation for this field.

SNAREDATAMAP

All unclassified field

/s in the log

(s) parsed from this log type will be pushed into the SNAREDATAMAP.

Note: See other fields here, which are common among all SharePoint* log types.

Notes

https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema?view=o365-worldwide#sharepoint-file-operations